What is the CVSS score of CVE-2026-63994?

CVE-2026-63994 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63994?

A critical vulnerability in the Linux kernel's IP tunnel handling (CVE-2026-63994) creates confidentiality and availability risk for organizations with tunnel-based infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-63994?

Within 24 hours, identify and inventory all Linux systems with IP tunnel configurations (including IPsec, GRE, VXLAN, and Geneve tunnels) and assess current kernel patch levels. Within 7 days, apply the latest kernel security updates available for your Linux distribution across all identified systems using a staged deployment approach, testing patches in non-production environments first before rolling to production. Within 30 days, verify 100% remediation of all affected systems and document the completed patching across your infrastructure.

Linux Kernel CVE-2026-63994

EUVD-2026-45567 CRITICAL

2026-07-19 Linux

GHSA-hvgq-ch9f-27rq

Information Disclosure Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network-triggerable via tunnel PMTUD but requires tunnel config plus a probabilistic skb_cow() reallocation race (AC:H); likely outcome is info leak (C:L) or crash (A:H), no reliable integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:43 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

CRITICAL 9.8

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head.

Fix this possible UAF by initializing the local variables after the skb_cow() call.

Remove skb_reset_network_header() calls which were not needed.

AnalysisAI

Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.

Technical ContextAI

The affected code lives in the kernel's IP tunneling layer (net/ipv4/ip_tunnel_core.c), which builds ICMP 'fragmentation needed' (ICMPv4 type 3 code 4) and ICMPv6 'packet too big' (type 2) messages when a packet exceeds the tunnel path MTU. iptunnel_pmtud_build_icmp() / iptunnel_pmtud_build_icmpv6() cached the network-header pointers returned by ip_hdr()/ipv6_hdr() before calling skb_cow(), a helper that may reallocate the socket buffer's linear data area (skb->head) to obtain writable headroom. If reallocation occurs, the previously saved pointers reference freed memory, so subsequent dereferences are a classic use-after-free (CWE-416, though the input lists CWE as N/A). The fix reloads ip_hdr()/ipv6_hdr() after skb_cow() and drops now-unnecessary skb_reset_network_header() calls. The reporter is credited as 'Sashiko'. Affected CPE is cpe:2.3:a:linux:linux (the mainline kernel); the bug was introduced by commit 4cb47a8644cc and predates it back to roughly the 5.9 series where this PMTUD helper path was introduced.

RemediationAI

Patch available per vendor advisory - upgrade to a fixed kernel: mainline 7.0.12 / 7.1, or the appropriate patched stable release for your branch (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, or 6.18.35). If you run a distribution kernel, apply the vendor's corresponding security update once it incorporates the upstream fix (git.kernel.org commits at https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4 and the sibling stable commits listed in the references). Where immediate patching is not possible, the practical compensating control is to remove or avoid IP/IPv6 tunnel interfaces (e.g. gre, ipip, sit, ip6tnl) on hosts that do not require them, since the vulnerable code only runs on the tunnel PMTUD path - the trade-off is loss of that tunneling functionality. There is no feature flag to disable PMTUD-triggered ICMP generation independently, so kernel upgrade is the reliable fix; general network filtering of oversized traffic to tunnel endpoints may reduce trigger frequency but does not eliminate the flaw.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63994 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63994

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code